1.0: Secure defaults, safer memory, and a leaner core

Agents Remember 1.0.0

The 1.0 release is a hardening pass over the whole MCP package: safer defaults on the public surface, real fixes in the memory-safety and benchmark paths, one coherent error and security model, and a leaner core (net −581 lines). It ships with a public stability promise and a fully green quality suite (ruff, Pyright, 359 tests, CRAP).

Highlights

• Secure-by-default benchmark execution. codex_benchmark_run no longer defaults to a full-access sandbox, and the benchmark tools are now gated behind a benchmarksEnabled setting — opt-in, with the execution/trust model disclosed in the README and settings reference.
• Memory-safety fixes. Branch-memory carryover now requires all path commits to have landed before it auto-accepts onboarding, and worktree integration is atomic — both fast-forwards are pre-validated and the code branch rolls back if the memory side fails.
• Corrected benchmark accounting. Token, command, and final-answer extraction now match the real Codex event schema; the published example numbers were regenerated (no more n/a columns or nonsensical command counts).
• One typed error family + centralized security guards. A single AgentsRememberError base, and path-confinement / repo-allowlist checks collapsed into shared, tested helpers instead of copy-pasted guards.
• Leaner, better-tested core. Net −581 lines — dead code, an inert tamper-detection feature, and theater tests removed; +70 real tests added (289 → 359), including the previously-untested parsers, the cgc lifecycle, and the benchmark analysis.
• Stability promise. From 1.0.0, skill IDs, MCP tool names and their inputs/outputs, the ar-coordination/ / ar-memory/ layout, and the settings schema do not change without a major version bump.

Security And Defaults

• codex_sandbox defaults to Codex's own default sandbox; "danger-full-access" is explicit opt-in.
• codex_benchmark_prepare / codex_benchmark_run refuse unless the settings set "benchmarksEnabled": true.
• Authority and configuration failures are reported through one typed error family (AuthorityError, ConfigError, LedgerError, ContractError, …) rather than bare exceptions.

Correctness And Memory

• Carryover exact-landed-commit proof tightened: every source-branch commit touching a path must be an ancestor of the official ref, not just one.
• Atomic worktree integrate with rollback on partial failure.
• Smaller contract fixes: timeoutCaps rejects unknown caps, benign provider-clone skips no longer count as failures, baseline-status ok reflects blocked-drift, response keys keep their computed values, provider scope is validated, and a bare markdown mode: falls back to the topology default instead of a phantom value.

Internals And Quality

• Typed WorktreeArgs and concrete provider-layout types replace argparse.Namespace / Any as cross-layer DTOs — which surfaced and fixed 5 latent None-handling bugs.
• DRY consolidation (one shared git runner, one slug/provider-settings helper), naming honesty fixes, and a dead-code sweep.
• Version now derives from package metadata (single source of truth).
• New behavior/safety conventions captured in the repo's coding guidelines.

Upgrading

• Public contracts are stable from 1.0.0 — see the README Stability section. Pin a version and read the notes before upgrading.
• If you use the benchmark tools, set "benchmarksEnabled": true and review codex_sandbox before any real (dry_run=false) run.